Advertisement
Over the years, cookies have been overlooked in forensic examinations. For the most part, cookies were used to show that a user account had accessed a website. Since no set structure for cookies existed, determining the content’s meaning was problematic. With the advent of Google Analytics (GA) cookies, that has changed. GA cookies use a set, documented structure that enables a forensic investigator to obtain useful information about a computer’s user.
 
GA cookies allow website operators to gather anonymous statistical information on their visitors. GA is a free service from Google™ with a 5 million-page view cap. To obtain unlimited page views, a Google AdWords™ account is required. To use the service, the Web site operator inserts Google-provided javascript into their Web site’s code that requests a small one-pixel image4 when the site is loaded. This ensures that the GA cookies are always first-party. The name, value, host, and path values within the cookies are present across Web browsers. This consistent format makes deciphering cookies a less onerous task. GA cookies also are found on Web-enabled devices such as smart phones and tablets.
 
Advertisement
Advertisement